The network address was being set to 192.168.122.0 instead
of 192.168.122.0/24. Fix this by removing the unneccessary
'network' field from virNetworkDef and just pass the
network address and netmask into the iptables APIs directly.
* src/conf/network_conf.h, src/conf/network_conf.c: Remove
the 'network' field from virNEtworkDef.
* src/network/bridge_driver.c: Update for iptables API changes
* src/util/iptables.c, src/util/iptables.h: Require the
network address + netmask pair to be passed in
---
src/conf/network_conf.c | 4 -
src/conf/network_conf.h | 1 -
src/network/bridge_driver.c | 62 ++++++++++++------
src/util/iptables.c | 149 +++++++++++++++++++++++++------------------
src/util/iptables.h | 24 +++++--
5 files changed, 142 insertions(+), 98 deletions(-)
diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 0bc5a54..3f2bf1f 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -438,10 +438,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt)
goto error;
}
- def->network = def->ipAddress;
- def->network.data.inet4.sin_addr.s_addr &=
- def->netmask.data.inet4.sin_addr.s_addr;
-
if ((ip = virXPathNode("./ip[1]", ctxt)) &&
virNetworkIPParseXML(def, ip) < 0)
goto error;
diff --git a/src/conf/network_conf.h b/src/conf/network_conf.h
index 5a01bbf..7d31693 100644
--- a/src/conf/network_conf.h
+++ b/src/conf/network_conf.h
@@ -72,7 +72,6 @@ struct _virNetworkDef {
virSocketAddr ipAddress; /* Bridge IP address */
virSocketAddr netmask;
- virSocketAddr network;
unsigned int nranges; /* Zero or more dhcp ranges */
virNetworkDHCPRangeDefPtr ranges;
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 5ee47eb..8721747 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -671,7 +671,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
int err;
/* allow forwarding packets from the bridge interface */
if ((err = iptablesAddForwardAllowOut(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev))) {
virReportSystemError(err,
@@ -682,9 +683,10 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* allow forwarding packets to the bridge interface if they are part of an existing connection */
if ((err = iptablesAddForwardAllowRelatedIn(driver->iptables,
- &network->def->network,
- network->def->bridge,
- network->def->forwardDev))) {
+ &network->def->ipAddress,
+ &network->def->netmask,
+ network->def->bridge,
+ network->def->forwardDev))) {
virReportSystemError(err,
_("failed to add iptables rule to allow forwarding to '%s'"),
network->def->bridge);
@@ -716,7 +718,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* First the generic masquerade rule for other protocols */
if ((err = iptablesAddForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
NULL))) {
virReportSystemError(err,
@@ -727,7 +730,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* UDP with a source port restriction */
if ((err = iptablesAddForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
"udp"))) {
virReportSystemError(err,
@@ -738,7 +742,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* TCP with a source port restriction */
if ((err = iptablesAddForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
"tcp"))) {
virReportSystemError(err,
@@ -751,22 +756,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
masqerr5:
iptablesRemoveForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
"udp");
masqerr4:
iptablesRemoveForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
NULL);
masqerr3:
iptablesRemoveForwardAllowRelatedIn(driver->iptables,
- &network->def->network,
- network->def->bridge,
- network->def->forwardDev);
+ &network->def->ipAddress,
+ &network->def->netmask,
+ network->def->bridge,
+ network->def->forwardDev);
masqerr2:
iptablesRemoveForwardAllowOut(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev);
masqerr1:
@@ -779,7 +788,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
int err;
/* allow routing packets from the bridge interface */
if ((err = iptablesAddForwardAllowOut(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev))) {
virReportSystemError(err,
@@ -790,7 +800,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
/* allow routing packets to the bridge interface */
if ((err = iptablesAddForwardAllowIn(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev))) {
virReportSystemError(err,
@@ -804,7 +815,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
routeerr2:
iptablesRemoveForwardAllowOut(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev);
routeerr1:
@@ -943,29 +955,35 @@ networkRemoveIptablesRules(struct network_driver *driver,
if (network->def->forwardType != VIR_NETWORK_FORWARD_NONE) {
if (network->def->forwardType == VIR_NETWORK_FORWARD_NAT) {
iptablesRemoveForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
"tcp");
iptablesRemoveForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
"udp");
iptablesRemoveForwardMasquerade(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->forwardDev,
NULL);
iptablesRemoveForwardAllowRelatedIn(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev);
} else if (network->def->forwardType == VIR_NETWORK_FORWARD_ROUTE)
iptablesRemoveForwardAllowIn(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev);
iptablesRemoveForwardAllowOut(driver->iptables,
- &network->def->network,
+ &network->def->ipAddress,
+ &network->def->netmask,
network->def->bridge,
network->def->forwardDev);
}
diff --git a/src/util/iptables.c b/src/util/iptables.c
index 64efd45..fc656b9 100644
--- a/src/util/iptables.c
+++ b/src/util/iptables.c
@@ -44,8 +44,9 @@
#include "virterror_internal.h"
#include "logging.h"
+#define VIR_FROM_THIS VIR_FROM_NONE
#define iptablesError(code, ...) \
- virReportErrorHelper(NULL, VIR_FROM_NONE, code, __FILE__, \
+ virReportErrorHelper(NULL, VIR_FROM_THIS, code, __FILE__, \
__FUNCTION__, __LINE__, __VA_ARGS__)
enum {
@@ -323,26 +324,55 @@ iptablesRemoveUdpInput(iptablesContext *ctx,
}
+static char *iptablesFormatNetwork(virSocketAddr *netaddr,
+ virSocketAddr *netmask)
+{
+ virSocketAddr network;
+ int prefix;
+ char *netstr;
+ char *ret;
+
+ if (!VIR_SOCKET_IS_FAMILY(netaddr, AF_INET) ||
+ !VIR_SOCKET_IS_FAMILY(netmask, AF_INET)) {
+ iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Only IPv4 addresses can be used with iptables"));
+ return NULL;
+ }
+
+ network = *netaddr;
+ network.data.inet4.sin_addr.s_addr &=
+ netmask->data.inet4.sin_addr.s_addr;
+
+ prefix = virSocketGetNumNetmaskBits(netmask);
+
+ netstr = virSocketFormatAddr(&network);
+
+ if (!netstr)
+ return NULL;
+
+ if (virAsprintf(&ret, "%s/%d", netstr, prefix) < 0)
+ virReportOOMError();
+
+ VIR_FREE(netstr);
+ return ret;
+}
+
+
/* Allow all traffic coming from the bridge, with a valid network address
* to proceed to WAN
*/
static int
iptablesForwardAllowOut(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev,
- int action)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev,
+ int action)
{
int ret;
char *networkstr;
- if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) {
- iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("Only IPv4 addresses can be used with iptables"));
- return -1;
- }
-
- if (!(networkstr = virSocketFormatAddr(network)))
+ if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
return -1;
if (physdev && physdev[0]) {
@@ -380,11 +410,12 @@ iptablesForwardAllowOut(iptablesContext *ctx,
*/
int
iptablesAddForwardAllowOut(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev)
{
- return iptablesForwardAllowOut(ctx, network, iface, physdev, ADD);
+ return iptablesForwardAllowOut(ctx, netaddr, netmask, iface, physdev, ADD);
}
/**
@@ -402,11 +433,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx,
*/
int
iptablesRemoveForwardAllowOut(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev)
{
- return iptablesForwardAllowOut(ctx, network, iface, physdev, REMOVE);
+ return iptablesForwardAllowOut(ctx, netaddr, netmask, iface, physdev, REMOVE);
}
@@ -415,21 +447,16 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx,
*/
static int
iptablesForwardAllowRelatedIn(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev,
- int action)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev,
+ int action)
{
int ret;
char *networkstr;
- if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) {
- iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("Only IPv4 addresses can be used with iptables"));
- return -1;
- }
-
- if (!(networkstr = virSocketFormatAddr(network)))
+ if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
return -1;
if (physdev && physdev[0]) {
@@ -471,11 +498,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx,
*/
int
iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev)
{
- return iptablesForwardAllowRelatedIn(ctx, network, iface, physdev, ADD);
+ return iptablesForwardAllowRelatedIn(ctx, netaddr, netmask, iface, physdev, ADD);
}
/**
@@ -493,18 +521,20 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
*/
int
iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
- virSocketAddr *network,
- const char *iface,
- const char *physdev)
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
+ const char *iface,
+ const char *physdev)
{
- return iptablesForwardAllowRelatedIn(ctx, network, iface, physdev, REMOVE);
+ return iptablesForwardAllowRelatedIn(ctx, netaddr, netmask, iface, physdev, REMOVE);
}
/* Allow all traffic destined to the bridge, with a valid network address
*/
static int
iptablesForwardAllowIn(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev,
int action)
@@ -512,13 +542,7 @@ iptablesForwardAllowIn(iptablesContext *ctx,
int ret;
char *networkstr;
- if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) {
- iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("Only IPv4 addresses can be used with iptables"));
- return -1;
- }
-
- if (!(networkstr = virSocketFormatAddr(network)))
+ if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
return -1;
if (physdev && physdev[0]) {
@@ -556,11 +580,12 @@ iptablesForwardAllowIn(iptablesContext *ctx,
*/
int
iptablesAddForwardAllowIn(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev)
{
- return iptablesForwardAllowIn(ctx, network, iface, physdev, ADD);
+ return iptablesForwardAllowIn(ctx, netaddr, netmask, iface, physdev, ADD);
}
/**
@@ -578,11 +603,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx,
*/
int
iptablesRemoveForwardAllowIn(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev)
{
- return iptablesForwardAllowIn(ctx, network, iface, physdev, REMOVE);
+ return iptablesForwardAllowIn(ctx, netaddr, netmask, iface, physdev, REMOVE);
}
@@ -744,7 +770,8 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx,
*/
static int
iptablesForwardMasquerade(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *physdev,
const char *protocol,
int action)
@@ -752,13 +779,7 @@ iptablesForwardMasquerade(iptablesContext *ctx,
int ret;
char *networkstr;
- if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) {
- iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("Only IPv4 addresses can be used with iptables"));
- return -1;
- }
-
- if (!(networkstr = virSocketFormatAddr(network)))
+ if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
return -1;
if (protocol && protocol[0]) {
@@ -819,11 +840,12 @@ iptablesForwardMasquerade(iptablesContext *ctx,
*/
int
iptablesAddForwardMasquerade(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *physdev,
const char *protocol)
{
- return iptablesForwardMasquerade(ctx, network, physdev, protocol, ADD);
+ return iptablesForwardMasquerade(ctx, netaddr, netmask, physdev, protocol, ADD);
}
/**
@@ -841,11 +863,12 @@ iptablesAddForwardMasquerade(iptablesContext *ctx,
*/
int
iptablesRemoveForwardMasquerade(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *physdev,
const char *protocol)
{
- return iptablesForwardMasquerade(ctx, network, physdev, protocol, REMOVE);
+ return iptablesForwardMasquerade(ctx, netaddr, netmask, physdev, protocol, REMOVE);
}
diff --git a/src/util/iptables.h b/src/util/iptables.h
index fd49685..ed843ec 100644
--- a/src/util/iptables.h
+++ b/src/util/iptables.h
@@ -44,29 +44,35 @@ int iptablesRemoveUdpInput (iptablesContext *ctx,
int port);
int iptablesAddForwardAllowOut (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
int iptablesRemoveForwardAllowOut (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
int iptablesAddForwardAllowIn (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
int iptablesRemoveForwardAllowIn (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *iface,
const char *physdev);
@@ -86,11 +92,13 @@ int iptablesRemoveForwardRejectIn (iptablesContext *ctx,
const char *iface);
int iptablesAddForwardMasquerade (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *physdev,
const char *protocol);
int iptablesRemoveForwardMasquerade (iptablesContext *ctx,
- virSocketAddr *network,
+ virSocketAddr *netaddr,
+ virSocketAddr *netmask,
const char *physdev,
const char *protocol);
int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx,
--
1.7.2.3
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list